f2fs: fix to avoid panic in f2fs_inplace_write_data()

[ Upstream commit 05573d6ccf702df549a7bdeabef31e4753df1a90 ]

As Jungyeon reported in bugzilla:

https://bugzilla.kernel.org/show_bug.cgi?id=203239

- Overview
When mounting the attached crafted image and running program, following errors are reported.
Additionally, it hangs on sync after running program.

The image is intentionally fuzzed from a normal f2fs image for testing.
Compile options for F2FS are as follows.
CONFIG_F2FS_FS=y
CONFIG_F2FS_STAT_FS=y
CONFIG_F2FS_FS_XATTR=y
CONFIG_F2FS_FS_POSIX_ACL=y
CONFIG_F2FS_CHECK_FS=y

- Reproduces
cc poc_15.c
./run.sh f2fs
sync

- Kernel messages
 ------------[ cut here ]------------
 kernel BUG at fs/f2fs/segment.c:3162!
 RIP: 0010:f2fs_inplace_write_data+0x12d/0x160
 Call Trace:
  f2fs_do_write_data_page+0x3c1/0x820
  __write_data_page+0x156/0x720
  f2fs_write_cache_pages+0x20d/0x460
  f2fs_write_data_pages+0x1b4/0x300
  do_writepages+0x15/0x60
  __filemap_fdatawrite_range+0x7c/0xb0
  file_write_and_wait_range+0x2c/0x80
  f2fs_do_sync_file+0x102/0x810
  do_fsync+0x33/0x60
  __x64_sys_fsync+0xb/0x10
  do_syscall_64+0x43/0xf0
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

The reason is f2fs_inplace_write_data() will trigger kernel panic due
to data block locates in node type segment.

To avoid panic, let's just return error code and set SBI_NEED_FSCK to
give a hint to fsck for latter repairing.

Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 03fa2c4d3d793f1846fd2aec4b70a376c0d55c21..8fc3edb6760c2fe97ca1b09c1199b61e9be7cf8e 100644 (file)
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -3069,13 +3069,18 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
 {
        int err;
        struct f2fs_sb_info *sbi = fio->sbi;
+       unsigned int segno;
 
        fio->new_blkaddr = fio->old_blkaddr;
        /* i/o temperature is needed for passing down write hints */
        __get_segment_type(fio);
 
-       f2fs_bug_on(sbi, !IS_DATASEG(get_seg_entry(sbi,
-                       GET_SEGNO(sbi, fio->new_blkaddr))->type));
+       segno = GET_SEGNO(sbi, fio->new_blkaddr);
+
+       if (!IS_DATASEG(get_seg_entry(sbi, segno)->type)) {
+               set_sbi_flag(sbi, SBI_NEED_FSCK);
+               return -EFAULT;
+       }
 
        stat_inc_inplace_blocks(fio->sbi);